CVV Fraud Rules: Federal Law, PCI DSS, and Bank Liability Explained

CVV fraud rules are not one rulebook. They come from three separate layers that stack on top of each other: federal criminal law, the private operating rules that Visa, Mastercard, Amex, and Discover impose on merchants and processors, and consumer protection regulations that cap what a cardholder can lose. The practical upshot is simple. Using someone else's CVV is a felony. Storing a CVV after an authorization is a contract violation that can get a merchant fined or cut off from card acceptance. And a cardholder who reports unauthorized use promptly is usually out fifty dollars or less.

What legally counts as CVV fraud

The card verification value is the three or four digit code printed on the card. It exists to prove the person typing the number is holding the physical card. When that code is used without the cardholder's authorization, the conduct falls under a handful of federal statutes rather than a single "CVV fraud" charge.

• 18 U.S.C. § 1029 covers access devices, a category that includes card numbers, CVVs, and the tools used to traffic them. Producing, selling, or possessing them with intent to defraud is a federal offense.
• 18 U.S.C. § 1343 wire fraud applies whenever the scheme crosses state lines or uses electronic communication, which is nearly always.
• 18 U.S.C. § 1028 identity theft is added when the fraud involves another person's identifiers.

Penalties under § 1029 run up to ten years for a first offense and up to twenty for repeat or aggravated cases, with fines on top. Sentences stack when prosecutors charge multiple counts.

The card network storage ban

This is the rule that trips up businesses most often. Visa, Mastercard, and the other networks prohibit merchants, processors, and gateways from retaining the CVV, CVV2, or CVC2 after a transaction is authorized. You may transmit it, validate it, and pass it through in the authorization message. You may not write it to a database, a log file, a receipt, or an order record. Full card numbers may be stored if encrypted and masked under PCI DSS, but the verification code never may be, not even encrypted.

The rationale is straightforward. If the code is never at rest, a breach of the merchant database cannot leak it, and a stolen card number alone is far less useful for card-not-present fraud.

PCI DSS requirements that back it up

PCI DSS Requirement 3.2 classifies the CVV as sensitive authentication data and states it must not be stored after authorization, even if encrypted. Requirement 3.3 covers masking when card numbers are displayed, and Requirement 4 governs encryption in transit. Non-compliance is enforced through acquiring banks, which can levy monthly fines and ultimately revoke a merchant's ability to accept cards. That commercial consequence usually bites faster than any regulator.

What the cardholder can lose

Consumer liability is capped by regulation, not by the network's goodwill.

• Regulation Z, which implements the Truth in Lending Act, limits credit cardholder liability for unauthorized use to $50, and most issuers waive even that.
• Regulation E governs debit cards. Liability depends on how fast you report: within two business days the cap is $50, within sixty days it is $500, and beyond that the exposure can grow.
• The Fair Credit Billing Act gives you sixty days from the statement date to dispute a charge in writing, and the issuer must investigate.

3-D Secure and who eats the loss

When a merchant runs a transaction through 3-D Secure and the issuer authenticates the cardholder, liability for a fraud chargeback generally shifts to the issuer. That is why so many checkout flows push a verification step. If authentication is attempted but the merchant skips it, or the issuer does not support it, the liability can shift back. Chargeback reason codes for fraud and for authorization-related errors sit at the center of most disputes between merchants and acquirers.

Who enforces what

The Department of Justice and U.S. Secret Service handle criminal prosecutions. The FTC pursues deceptive practices and data security failures under its authority over unfair or deceptive acts. State attorneys general can bring their own consumer protection claims, and many states have separate identity theft and card fraud statutes with their own penalty ranges. Private litigation is common too, usually brought by issuers seeking to recover losses from a merchant or processor that mishandled data.

If you handle card data at work

Keep the scope small. Never let the CVV touch a system that writes to disk. Segment the network so the payment path is separate from everything else. Log access to cardholder data and review it. Train staff on why the code cannot be written down, because the habit of jotting it on an order slip is the single most common violation I have seen in small operations.

If your card number was used

Call the issuer first and ask them to close the account and issue a new number. Then put the dispute in writing within the sixty-day window. File a report with the FTC at IdentityTheft.gov and, if local police will take it, keep the report number. The paper trail matters if the issuer pushes back or if the same number shows up again months later.